Repository navigation
V5 is not available from the Wordpress plugin directory #930
Description
Checklist
- I have looked into the Readme and the documentation, and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Description
Our Wordpress website is administered in the standard low-tech manner, where all plugins and other changes are made through the built-in Wordpress admin UI (/wp-admin/plugins.php).
Although version 5 has been available for over 2.5 years, and version 4 has been considered unsupported for 2 years, the latest version available through the Wordpress admin UI (via the Wordpress plugin marketplace) is only 4.6.2. Also the latest 5.x release published to GitHub are source code only -- they lack a built version of the plugin that could be downloaded and then manually uploaded through the admin UI to upgrade. Therefore, standard Wordpress installations maintained through the admin UI are effectively stuck on an unsupported version of the plugin and unable to upgrade.
Last year (in May), I filed an Auth0 support ticket #02351670 requesting assistance, and I received the following response:
Unfortunately, it's not currently possible to publish a built version in a zip file.
Please look into using Composer for this update.
We're working to get the Marketplace release of V5 as soon as we can.
Migrating to Composer requires significant technical expertise and investment in tooling + build/deploy infrastructure that is a much higher bar than a few clicks in the admin UI, so this requirement is a non-starter for us, as our technical expertise lies in other areas and our Wordpress site is simply used for hosting some protected content accessible to our user base (whose accounts are managed in Auth0).
Since my ticket was closed, https://community.auth0.com/t/auth0-wordpress-plugin-v4-issues/141062 was published last August recommending that users upgrade to v5 of the plugin, but without mentioning the lack of an upgrade option for users who maintain their Wordpress through the admin UI.
Since 28 months have passed since v4.x became unsupported, and 9 months have passed since Auth0 indicated a marketplace release of v5 will be available "as soon as we can", I'm filing this issue in hopes of finally gaining some traction on this. Please let me know if I should direct this request elsewhere.
Reproduction
Open https://wordpress.org/plugins/auth0/ and observe that version 4.6.2 is the latest version.
Additionally, observe that this is documented method for installing the plugin: https://auth0.com/docs/customize/integrations/cms/wordpress-plugin/install-login-by-auth0:
This plugin can be added to your WordPress site using the Plugins screen in the wp-admin:
- Log in to an existing WordPress site as an administrator.
- Go to Plugins > Add New in the admin menu on the left.
- Search for "Login by Auth0"
- For the Login by Auth0 plugin, click Install Now, then Activate.
Open https://github.com/auth0/wordpress/releases/tag/5.3.0 and observe that the only assets are "Source code" bundles.
Additional context
This issue is a recreation of #923 (with updated timelines), since that issue was closed as "completed" with the comment that the team is "actively working on it", but there have been no updates for over 4 months, and I am unable to reopen the original issue.
wp-auth0 version
4.6.2
WordPress version
6.8.1
PHP version
8.3
Activity
kishore7snehil commentedon Jun 5, 2025
Hi @robbytx, thanks so much for the detailed report and for patiently following up on this.
You're absolutely right that version 5.x is not currently available through the WordPress plugin marketplace, and this is unfortunately still the case due to a few challenges we’re working through as maintainers.
A few of the blockers we’re facing:
Build + packaging compliance: The WordPress plugin marketplace has specific requirements for distributed zip bundles that don’t align cleanly with our Composer-based build pipeline. This requires us to manually maintain and validate a separate release flow.
Plugin metadata & signature validation: Marketplace submission requires some structural and metadata changes (e.g. stable tag syncing, changelog formatting, translation domain declarations) that aren’t enforced when releasing via GitHub alone.
Testing overhead for legacy environments: Marketplace distribution increases the scope of environments we need to support and test — including setups that use no modern PHP tooling (as in your case). This takes time and coordination we haven’t fully resourced yet.
We completely understand how this limitation impacts low-tech or admin-UI-only WordPress setups, and it’s a valid concern. Our goal is still to make v5.x available on the marketplace — we just haven’t reached the point where we can safely and sustainably do that.
That said, your message is a helpful nudge. I’ve shared this internally again, and we’ll aim to prioritize it more visibly.
In the meantime, if anything changes or we need clarification on your setup when finalizing packaging, we’ll follow up here. Thanks again for the thorough report and for raising this in good faith.
graham73may commentedon Aug 12, 2025
Hi all,
Coming late to the party here but just wanted to flag that this page is still funnelling people towards version 4.6.2:
https://auth0.com/wordpress
The Download plugin button at the top goes to the WordPress plugin directory with 4.6.2. Could this instead go to the Github releases page?
The How it Works section also gives a step by step for installing the plugin from the WordPress plugin directory. Could this instead give steps for uploading a .zip to the WordPress plugin screen?
The docs also seem to be focused on V4, e.g. https://auth0.com/docs/customize/integrations/cms/wordpress-plugin/extend-login-by-auth0
I've just finished implementing 4.6.2 on a site and have only just seen there's a version 5.
Thanks,
robbytx commentedon Oct 16, 2025
@kishore7snehil any updates on this since June? Has it received any attention in your team's prioritization discussions?
The Wordpress page lists 10,000+ active installations:
And you are starting to get negative reviews:
kishore7snehil commentedon Oct 16, 2025
Hi @robbytx, thanks for the follow-up and for highlighting the urgency here. You're right to push on this.
Since my last update in June, we've been working through the blockers I mentioned, and I want to give you a concrete update on where we are:
What's ready now:
The
v5.4.0release is built and includes a critical security fix (CVE-2025-58769). I've also prepared a plugin-ready zip that can be manually installed through wp-admin - no Composer required. I can attach this to the GitHub release immediately if that helps your situation.What's still blocking marketplace deployment:
The challenge we're still working through is that v5 is a complete rewrite, and there's currently no automatic migration path from
v4settings tov5. If we pushv5as the stable version onWordPress.orgright now, all 10K+ users would auto-update and lose their Auth0 configuration, requiring manual reconfiguration. That's a breaking change we can't responsibly deploy without either:We're also coordinating with our docs team to update the installation guides and ensure users have proper upgrade instructions.
What I'm proposing:
Given the urgency, I'm advocating internally to deploy
v5.4.0to theWordPress.orgtrunk (not as stable) within the next week or two. This would makev5available for testing while keeping existing users onv4.6.2until we have migration support ready. Advanced users could opt into the trunk version, and we'd gather feedback to improve the migration experience before the stable release.I'm also working on getting pre-built zips attached to all GitHub releases going forward, so manual installation is always an option.
For your immediate needs:
If you need
v5now, I can provide the plugin-ready zip today. You'd need to manually reconfigure your Auth0 settings after installation, but it would get you offv4.6.2. Let me know if that works for you, and I'll make it available.I completely understand the frustration, and the negative reviews reflect that. I'm pushing to get this resolved as quickly as we can while protecting the existing user base from a breaking auto-update. I'll keep this thread updated as we make progress.
robbytx commentedon Oct 16, 2025
@kishore7snehil thank you for the update. What you've shared is promising, and I look forward to either (a) upgrading via manual install, or (b) installing directly from Wordpress.org once you have the migration scenarios described.
As for the urgency, CVE-2025-58769 certainly sounds concerning -- does it require administrative privileges to access, or is it exploitable by any authenticated user?
kishore7snehil commentedon Oct 16, 2025
@robbytx ,Good question on the CVE details. CVE-2025-58769 is specific to the Bulk User Import endpoint in the Auth0-PHP SDK (versions 3.3.0–8.16.0) and has a CVSS score of 3.3 (LOW severity).
To answer your question directly: it requires administrative privileges to exploit and it's not exploitable by regular authenticated users.
The vulnerability affects the file path validation in the bulk import functionality, which is typically only accessible to administrators. Still, it's a security issue we wanted to address promptly, which is why it's included in
v5.4.0.For your use case, if you're not using the bulk user import feature or you have proper admin access controls in place, the immediate risk is minimal. But upgrading to
v5.4.0(via manual install) would address it completely.Let me know if you have other questions about the CVE.
kleurvision commentedon Dec 4, 2025
We are in the same boat here with a client using Auth0 on a low-tech intall of WordPress without an immediate budget to rebuild. @kishore7snehil you've offered to provide a v5.4.0 zip for @robbytx — can you do the same for us?
kishore7snehil commentedon Dec 16, 2025
Hi @kleurvision, I've just released v5.5.0 which includes the plugin-ready zip file you can manually install through
wp-admin.Download the release here: https://github.com/auth0/wordpress/releases/tag/5.5.0
You'll find two files attached:
A. Auth0_WordPress_5.5.0.zip - The plugin package ready for WordPress installation
B. Auth0_WordPress_5.5.0.zip.sig - Digital signature for verification (optional)
To install:
Download Auth0_WordPress_5.5.0.zip
In WordPress admin, go to Plugins → Add New → Upload Plugin
Upload the zip file and activate
Note: This release also includes a critical security fix (CVE-2025-68129).
Let me know if you run into any issues!
risturiz commentedon Jan 28, 2026
Hi, what is the best path with 5.4 upgrade? Manual upgrade from cli or install this 5.5 from Wordpress Admin and configure again?
Thanks!
kurtseifried commentedon Apr 13, 2026
Is there an ETA on Auth0 plugin v5 being available in the Wordpress marketplace? This ticket is almost one year old at this point.
Just confirmed: https://wordpress.com/plugins/auth0
Version 4.6.2
Active installations 10K
Last updated Jul 12, 2024